Difference between revisions of "Main Page"

From ForensicsWiki
Jump to: navigation, search
m
m
Line 11: Line 11:
 
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffff99; align:center; border:1px solid #ddccff;">
 
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffff99; align:center; border:1px solid #ddccff;">
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
 +
 +
<small>August 2011</small>
 +
 
<bibtex>
 
<bibtex>
@article{fiorillo-flash,
+
@article{beverly:ipcarving,
  title="Theory and practice of flash memory mobile forensics",
+
  author = "Robert Beverly and Simson Garfinkel and Gregory Cardwell",
  year=2009,
+
  journal = "Digital Investigation",
  author="Salvatore Florillio",
+
  publisher="Elsevier",
  url="http://ro.ecu.edu.au/adf/67/",
+
booktitle = {Proc. of the Eleventh Annual DFRWS Conference},
  publisher="School of Computer and Information Science, Edith Cowan University, Perth, Western Australia",
+
  title = "Forensic Carving of Network Packets and Associated Data Structures",
  abstract="This paper is an introduction to flash memory forensics with a special focus on completeness of evidence acquired from mobile phones. Moving through academic papers and industrial documents will be introduced the particular nature of non-volatile memories present in nowadays mobile phones; how they really work and which challenges they pose to forensic investigators. Then will be presented an advanced test in which some brand new flash memories have been used to hide data in man-made bad blocks: the aim is to verify if forensic software tools are able to acquire data from such blocks, and to evaluate the possibility to hide data at analysts’ eyes."
+
volume=8
 +
year = 2011,
 +
  abstract="Using validated carving techniques, we show that
 +
  popular operating systems (\eg Windows, Linux, and OSX)
 +
  frequently have residual IP packets, Ethernet frames,
 +
  and associated data structures present in system memory
 +
  from long-terminated network traffic. Such information is useful
 +
  for many forensic purposes including establishment of
 +
  prior connection activity and services used;
 +
  identification of other
 +
  systems present on the system's LAN or WLAN; geolocation of the
 +
  host computer system; and cross-drive analysis. We show that network structures can also be
 +
  recovered from memory that is persisted onto a mass storage medium
 +
  during the course of system swapping or hibernation.
 +
  We present our network carving techniques, algorithms and tools,
 +
  and validate these against both purpose-built memory images and a readily
 +
  available forensic corpora.  These techniques are
 +
  valuable to both forensics tasks, particularly
 +
  in analyzing mobile devices, and to cyber-security objectives such
 +
  as malware analysis."
 
}
 
}
 +
 +
 
</bibtex>
 
</bibtex>
 +
 +
(See also [[Past Selected Articles]])
  
 
| width="40%" style="vertical-align:top" |
 
| width="40%" style="vertical-align:top" |

Revision as of 06:55, 6 August 2011

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 741 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.

Featured Forensic Research

August 2011

Robert Beverly, Simson Garfinkel, Gregory Cardwell - Forensic Carving of Network Packets and Associated Data Structures
Digital Investigation 8,2011
Bibtex
Author : Robert Beverly, Simson Garfinkel, Gregory Cardwell
Title : Forensic Carving of Network Packets and Associated Data Structures
In : Digital Investigation -
Address :
Date : 2011

(See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


Topics



You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.